- cypherpunks-legacy - lists.cpunks.org

Re: JavaScript to grab email
by Sean A. Walberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If you don't have a mail server set up, it won't send (PC version at least). Fine by me, cuz I just copy the address into Pegasus to send mail. YMMV. Sean > Another annoying feature in JavaScript and Netscape. Have a look at > <http://www.popco.com/grabtest.html> > > The page uses JavaScript to steal your e-mail address and sends a test > e-mail message to the address it grabbed. It works with Netscape, which > is probably only browser supporting JavaScript. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMSqKGd82JgvRKzQZAQGyTwQAiKo1XUGZHPCgrwJU2ZWM/aREb/LHAebi kGDWNyC4qFrDkB//A2jN6ZWckdEuuCvX+OKLyYZHWTZ/sTjvi7WDsTprrXt96mZV ho1TB3nzemzRVZVO9aWUW/Zhpa+fi0MoSAlZC5ZFsdvnrEZUJSEbd5S1aubPA/gc 2/Zf6v1rbNw= =W/Fp -----END PGP SIGNATURE----- =================] Will work for RAM [================== | Sean A. Walberg | PGP key | C programmers | | Computer Engineering ][ | on | do it in | | umwalber(a)cc.umanitoba.ca | servers | libraries! | =============] http://www.escape.ca/~sean [=============

1 0

Secure Split
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! this is the second time I post this to CP. Where can I get Secure Split? Apparently, it is a program to split a key in m parts, where n (<m) parts could rebuild the key. I saw that name in Nautilus manual (a pgpphone lookalike for dos). I looked through Alta Vista and the only thing I found was a post on CP by somebody else looking for it, in 1994 (?) Does such a program exists? If yes, where can I get it? Regards JFA **** NEW PGP 2.6.2 KEY ********* This key is actually suspended, as of Feb, 16 1996, was never distributed, and might be subject to deletion. Sorry for the trouble my mis-management might have caused. 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

2 1

Re: JavaScript to grab email
by Mike Rose 17 Dec '03

17 Dec '03

>>>>> On Tue, 20 Feb 96 14:40:30 EST, Mike Rose <mrose(a)stsci.edu> said: >Changing the email address known to netscape doesn't help. Your email >address is in the message sent, regardless of what netscape thinks >your identity is. Sorry for the imprecision here. I was referring to Netscape 2.0 on unix here. Changing the email address known to netscape is insufficient for non-root users on unix systems, because sendmail will put your real address into the headers. The auto-responder used by the posted example page apparently isn't sophisticated enough to extract the real address, but the address is still in the headers for someone to extract. For those who haven't read the script, the technique used is as follows. A java script sends a mail message to the author of the script. The identity of the sender is in the mail headers. The script does not look at netscape variables or otherwise get the information from netscape or the environment. The major point is that setting a bogus email address in netscape will not necessarily prevent your email address from being captured in this manner. Mike

5 4

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 6:46 PM 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this <...> IPG, why don't you sit down and draw up the terms of a challenge? Specify: * what information and/or materials IPG will release * to whom it will release them and when * who is or isn't elligible * what you will and won't accept as "breaking your system" * the arbitrating body * a starting time and a deadline * the award You'd do well to be _very_ thorough in these terms, since any perception that IPG was trying to throw the game would draw that much more fire. You'd also do well to make terms terms conform to real-world circumstances: for example, if someone hacking the office machines on which which you generate, store, and/or disseminate RNs is a practical threat to your product, then admit that as an acceptable part of a "break." Ted

5 7

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:46 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this in my first >reply - in addition to giving you the company if you can break the >system, we will give you the company if you can establish, through our >employees or any other method, that we retain any Ocopies of the TPs, >any! - for very large systems, we maintain a temporary copy to insure >safe arrival, by excuting the check system menu item - >it is immediate destroyed upon system notification. Anyone that wants to >audit us cazn do so, unannounced at any time - subject to payment ofd >expenses! We do not keep copies, we would not be in business 30 days if >we did. It is irrelevant if you keep copies of the OTPs or not. The point is that you might. There is no way to prove to me or anyone else that you don't keep copies. [why this is true is left as an exercise to the reader]. I would not trust anyone outside my company to create keys for us. I would urge any others interested in keeping their data inaccessible to outsiders to exercise the same fundamental caution. There is no further need to look at IPG's source code or algorithms. As I said, end of story. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 06:10 PM 2/20/96 -0600, you wrote: >> ** fairly remarkable coincidences. Or is it that great minds >> think alike? > >heh, actually the Elementrix POTP sounds like plaintext-driven autokey >cipher and probably wouldn't be offensive if they weren't touting it as a >'OTP'... > Yes, that's true, but they also allude to "a large number of randomly spinning dice" [rotors?] of which some are selected by contents [perhaps] the autokey stream. This from a discussion held with the POTP people. The allusion to the numerous 'dice' is what suggested to me a similarity with the new [unknown but perfect, of course] system. The autokey of POTP was supposedly only part of the scheme....

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Can't you just run a dumb TCP relay? I used to have one somewhere, but I can't remember if I solarified it to run with multi-threading. I can try and dig it up, but it'd probably be faster for you to rewrite from scratch. I also have a ssl proxy for the client side which I wrote to demo the MITM attack, but that doesn't sound like what you need. Simon On Tue, 20 Feb 1996, Lucky Green wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > I need firewall software, preferably for free and running on an x86, that > allows me to place an SSL webserver behind the firewall. > > Any pointers? > > TIA, > > - -- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. > > > - --- > [This message has been signed by an auto-signing service. A valid signature > means only that it has been received at the address corresponding to the > signature and forwarded.] > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > Comment: Gratis auto-signing service > > iQBFAwUBMSpFICoZzwIn1bdtAQF3YgGAnt2V+2sTgv7cHDu0k3HZ/664sFbYsu9V > 4sWnsBNuJoMRVlG4RbxE/iERpu0nR6ZF > =kPCC > -----END PGP SIGNATURE----- > > --- They say in online country So which side are you on boys There is no middle way Which side are you on You'll either be a Usenet man Which side are you on boys Or a thug for the CDA Which side are you on? National Union of Computer Operatives; Hackers, local 37 APL-CPIO

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Credit card check sums are based on the Luhn code. Double the odd digits (1, 3, 5, etc.). Use the sum of any 2-digit results. Add all these numbers together to end up with one single digit. Add this single digit to the sums of all the even digits. The Luhn check digit is the mod 10 of that final subtotal. For example 641205002340106 yields 4. jwhiting

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

I have been following this debate with some interest. I think that it is quite clear that without your publishing the algorithms for your product, you have to accept our skepticism obout your claims. You have offered to do this so I will wait to make my judgement. The issue that I have not seen you address is one that has been brought up by several posters to this thread. This issue has to do with the fact that if you generate all of the keys (or whatever) what is to stop someone from offering one of your employees a LARGE bribe to cough up the keys? I don't think that anyone on this list would accept as secure any system, no matter how clever, that relies on a human factor. People are weak, properly used, mathematics is not. To suggest that such a security breach would not occur with your procedures is disingenuous in the extreme. I am not trying to start (or continue) a flame war. I am willing to learn more about your system before I pass judgement but I must tell you, however, that I have heard nothing yet to give me any confidence that your system is secure. Regards, Tim Philp =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> Date: Tue, 20 Feb 1996 14:50:00 -0600 > From: Nemesis <richier(a)Onramp.NET> > To: cypherpunks(a)toad.com > Subject: (no subject) > How do i get off the mailing list?????? reply follows------------------------------------------------------- to unsubscribe from the cypherpunks mailing list, send to: majordomo(a)toad.com an e-mail message with the following text in the body of the message: unsubscribe cypherpunks richier(a)onramp.net -- buenas suerte, nemesis. p.s. -- a little hint: if your mail reader lets you save messages rec'd in folders or some such thing, you should save all the messages you get from mailing list software (like the first two messages you got from cypherpunks) in a sepaprate folder (like one called 'lists'.) Then you will be able to go back and unsubscribe or sign off when you want. I'm thinking of putting the how to unsubscribe info for RFC-Dist and IETF-Announce (and maybe c.punks) in a .sig file - but I hate sigs so. ------------------------------------------------------------------------ obligatory crypto comment: has anyone looked at the iPower card and gotten one to play with? Where else could one get a PCMCIA card that was programmable and had a little memory on it? How hard would it be to make one - in other words, what could we get the cost down to for an encrypting pcmcia card? there couldn't be much to it, really, could there? ------------------------------------------------------------------ latest word from the other room: Buchanan 27%, Dole 26%, Lamar 13%

1 0